Mac Screen Sharing Is Under Attack, Plus 4 Tech Stories
Tuesday’s news is mostly a collection of reminders that “already patched” and “probably fine” are not the same thing.
The most important update is on Apple’s Screen Sharing vulnerability from Monday’s brief. At the time, the useful advice was simple: install the macOS update. We now know attackers were already exploiting exposed Macs, which moves this from routine patching into something administrators should actively check. WordPress and self-hosted GitLab also shipped serious security fixes, a finance-company breach exposed the kind of personal information that follows people around for years, and Google pushed Gemini further into K–12 classrooms.
Apple’s Screen Sharing flaw is being exploited
The macOS Screen Sharing vulnerability I mentioned yesterday has already graduated from theoretical to demonstrated. CVE-2026-65400 can allow a network attacker to authenticate to Screen Sharing without valid credentials, and Apple patched it in Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9.
The Netherlands’ National Cyber Security Centre says it received reports of active exploitation on multiple systems where port 5900 — the port commonly used for VNC and Screen Sharing — was reachable from the public internet. In the reported cases, attackers gained root access and installed a Monero cryptocurrency miner.
The miner is almost beside the point. Root access means the attacker had the highest level of control over the Mac. A cryptominer is what investigators saw, not the upper limit of what that access could have been used for.
This also gives us another episode of a very old security series: please stop putting remote-management services directly on the public internet. Screen Sharing is useful. Forwarding port 5900 through the router because it is convenient also means every automated scanner on the internet gets to knock on that door.
If you use one of the affected macOS versions, update it. If you administer Macs with Screen Sharing or VNC exposed externally, verify that they are patched and move that access behind a VPN or another controlled access layer. And if a machine was publicly exposed and unpatched while exploitation was happening, patching is not the whole job. Check for unexpected processes, persistence, accounts, or other evidence that somebody got there first.
The boring machines need attention too
Browsers, workstations, remote-access tools, Wi-Fi, and ordinary office hardware rarely get much attention until one of them becomes the problem. Raymond Tec provides onsite IT and field services around Reading, Pennsylvania, along with practical help keeping the technology people use every day working and reasonably secure.
WordPress 7.0.4 fixes an ugly RCE with important prerequisites
WordPress 7.0.4 fixes CVE-2026-65640, a remote code execution vulnerability rated 8.8 out of 10. “Remote code execution in WordPress” is the scary headline. The useful version needs the prerequisites.
A vulnerable server has to be using both Imagick and Ghostscript, and the attacker already needs the upload_files capability — typically an Author-level account or equivalent. The attack involves a specially crafted upload that WordPress treats as an image while ImageMagick recognizes embedded PostScript and hands it to Ghostscript. That PostScript can then execute on the server.
So no, this is not an anonymous visitor taking over every WordPress installation on Earth. But “requires a logged-in user” does not mean harmless. Compromised contributor credentials happen, and an account allowed to upload media is not supposed to turn into a path for arbitrary server commands.
Update WordPress core to the patched release for your branch. Multi-author, membership, community and client sites where more people can upload files deserve extra attention. While you are there, it is worth asking which accounts still need upload privileges. Permissions have a funny way of becoming permanent long after the reason for them disappears.
Heights Finance breach exposes the identity-theft starter kit
Heights Finance says an attacker accessed a third-party cloud platform used to store customer data, affecting at least 1.2 million people according to state notifications reported by SecurityWeek.
Depending on the person, the exposed information may include names, addresses, phone numbers, email addresses, bank names, account and routing numbers, Social Security or tax ID numbers, driver’s-license or state-ID numbers, and dates of birth. In other words, not the sort of breach where changing one password puts the problem behind you.
Heights says its loan-management systems and other networks were not affected, and its monitoring provider had not found the stolen information on the dark web as of the notice. That is better than the alternative, but “we haven’t found it for sale” is not the same as “nobody copied it.”
The notice may cover current customers, applicants, people who only inquired about a loan, and some former borrowers of related companies. Heights is offering 24 months of credit monitoring and identity-protection services, with enrollment due by November 9. If you are affected, take the offer, watch financial accounts and credit reports, and seriously consider a credit freeze. Social Security numbers do not become less useful to criminals when this story falls off the front page.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
Self-hosted GitLab has a 9.4-severity unauthenticated flaw
If you run GitLab yourself, this one belongs near the top of the maintenance list.
GitLab patched CVE-2026-19478, a 9.4-severity flaw in its GraphQL interface that, under certain conditions, can let an unauthenticated attacker remotely modify or delete public projects and user data. A second GraphQL issue, CVE-2026-19650, is rated 7.1.
GraphQL is just an interface software uses to ask GitLab for information or tell it to do something. The important bit is that GitLab was not enforcing the boundaries it was supposed to enforce. That is a particularly bad place for an authorization mistake in a product storing source code, project history, issues and other development records.
This is mainly a self-managed GitLab problem. GitLab.com and GitLab Dedicated were already patched. GitLab also says the fix does not add database migrations and multi-node deployments generally should not require downtime, so there is not much of an operational excuse to leave a vulnerable self-hosted instance sitting around.
Google Gemini is moving further into K–12 classrooms
Google is expanding Gemini in Classroom to students of all ages, including K–12. Students can use class and assignment context to build flashcards, practice quizzes, study guides and other learning aids rather than asking a generic chatbot questions with no idea what they are studying.
The interesting part is not whether AI can make a quiz. Of course it can. It is that schools now have to decide where the line sits between helping a student learn and doing the intellectual work for them.
Access is controlled by Google Workspace administrators, although Google says the Gemini in Classroom control is on by default for teachers and students unless a school previously disabled student access. That makes this worth an actual policy review rather than an assumption that somebody else has handled it.
A second grader and a high-school senior obviously do not need the same rules. “AI in school” is not a policy; it is a category of questions. Schools need to know what is enabled, explain what is acceptable, and make sure teachers, students and parents are not all operating under three different assumptions.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Five stories, one boringly consistent lesson
There is not one grand theme tying all of Tuesday together, and I am not going to torture one into existence. But there is a smaller one: technology gets complicated fast when the defaults, permissions, exposed services and vendor settings are allowed to make decisions for us.
Sometimes the answer is patch the Mac. Sometimes it is review who can upload files, freeze your credit, update GitLab, or actually decide how AI belongs in a classroom. None of that is particularly glamorous. A surprising amount of useful technology work is knowing which boring thing deserves attention before it becomes exciting.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
macOS Screen Sharing exploitation
- Netherlands National Cyber Security Centre: NCSC-2026-0280
- SecurityWeek: Recent macOS Screen Sharing Vulnerability Exploited in Attacks
WordPress 7.0.4
- WordPress security advisory: GHSA-8vr3-7mxf-gx8w
- SecurityWeek: WordPress 7.0.4 Patches Remote Code Execution Vulnerability
Heights Finance breach
- Heights Finance: Notice of Data Breach
- SecurityWeek: Heights Finance Data Breach Impacts at Least 1.2 Million Individuals
GitLab critical patch
- GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
- SecurityWeek: GitLab Patches Critical Code Injection Vulnerability
